Earth Observation Data Sovereignty in Nigeria: Reconciling the Data Protection Act 2023 with the National Space Regulatory Framework

1Introduction

In October 2026 the Director-General of the National Space Research and Development Agency (NASRDA) said that procurement for Nigeria’s next satellites was 95 per cent complete. The program, estimated at USD 2 billion, includes three optical earth observation satellites at sub-meter resolution and radar satellites at one-meter and finer resolution (Azubuike, 2026). Earlier announcements described a constellation of three optical satellites and one radar satellite for precision farming, earth observation and services to the defence, maritime and oil and gas sectors (Adetola, 2024; Nyangi, 2024). The current national satellites, NigeriaSat-2 and NigeriaSat-X, were launched in 2011 with a design life of seven years and are due to be deorbited (NASRDA, 2025a).

Sub-meter imagery changes what earth observation data can reveal. Scholars of space-based data have observed that privacy questions were limited while resolution was low and are likely to grow as it rises (Bu-Pasha & Kuusniemi, 2021). Very high-resolution imagery, combined with automated image analysis, may allow individuals to be identified (Rapp & Santos, 2019). Shi (2022) argues that imagery is personal data when it reveals identifiers or can be linked to a person, for example through a house or a property, and that identifiability shifts as technology improves. None of this makes an image of a field a privacy problem. It does mean that a lawful archive of national imagery can, at some point in its processing, become a store of personal data.

2The Space Data regime

NASRDA was established in 1999 and operates under the federal science ministry (NASRDA, n.d.). Its mandate includes a data function: it is to be the repository of all satellite data over Nigeria’s territory, to maintain the national archive of that data, and to take part in collaborations on space data in Nigeria (NASRDA, n.d.). Faleti (2021) identifies the repository duty as section 6(k) of the NASRDA Act 2010. The same Act sets the licensing conditions. Under section 9, the Agency may not grant a license unless it is satisfied that the activity will not endanger public health or safety, will not impair national security and is consistent with Nigeria’s international obligations, and conditions include third-party liability insurance (Faleti, 2021). Faleti reads the licensing system as covering satellite remote sensing.

The detailed regime is more recent. Licensing regulations made in 2015 took effect in 2021 and introduced a formal licensing regime for entities operating space objects or conducting space activities (Afriwise, 2026). The 2025 Handbook, issued under section 35 of the Act, groups licenses into three categories (NASRDA, 2025b). Upstream licenses cover items such as satellite landing permits and spectrum access. Midstream licenses cover data processing, teleport services and GIS and land information software. Downstream licenses cover ground stations, launch facilities and space object manufacturing. Applications run through an online portal, and licensed operators face ongoing monitoring, with sanctions or revocation for non-compliance (NASRDA, 2025b).

Two features of the Handbook matter for this article. First, in the text I reviewed, none of the license categories mentions remote sensing, personal data, imagery resolution or data sharing; the nearest category is midstream data processing. Second, the midstream license is renewed annually, against three years for downstream and up to five for upstream. The category in which imagery is actually processed therefore comes up for review more often than any other, which gives the regulator a recurring point at which to attach data governance conditions. The framework is also still moving. At a 2025 stakeholder workshop, a senior lawyer described the 2001 national space policy, the 2010 Act and the 2015 regulations as outdated, while a new National Space Policy was being prepared (Iderawumi, 2025).

3The Data Protection regime and earth observation

The Nigeria Data Protection Act 2023 (Act No. 37) was signed on 12 June 2023 and published in the Official Gazette on 1 July 2023 (Federal Republic of Nigeria, 2023). It applies to the processing of personal data whether or not it is automated (s. 2(1)), and it extends to controllers and processors that are outside Nigeria but handle the personal data of data subjects in Nigeria (s. 2(2)). Personal data is “any information relating to an individual, who can be identified or is identifiable, directly or indirectly,” and the definition lists identifiers that include location data (s. 65). That breadth is what makes earth observation relevant. An image does not need to show a face to be caught; it needs only to be information that relates to an identifiable person.

Four further provisions bear on earth observation. Where processing is likely to result in high risk, the controller must carry out a data privacy impact assessment before processing and consult the Commission if risk remains (s. 28). A controller may not transfer personal data out of Nigeria unless the recipient country offers adequate protection, meaning principles substantially similar to those of the Act, or one of the listed conditions, such as consent, applies (ss. 41 to 43). Most obligations in Part V do not apply to processing by a competent authority as necessary for national security, although sections 24, 25, 32 and 40 continue to apply, and the Commission may issue guidance notices where exempt processing might breach sections 24 or 25 (s. 3(2)(c), s. 3(4)). And sanctions are real: for controllers of major importance, the maximum penalty is the greater of ₦10 million or two per cent of annual gross revenue (Banwo & Ighodalo, 2023).

The General Application and Implementation Directive (GAID) took effect on 19 September 2025, replacing the 2019 Nigeria Data Protection Regulation and its implementation framework. It introduces a standard template for data privacy impact assessments and addresses the use of emerging technologies such as artificial intelligence, blockchain and the internet of things in processing personal data (Aluko & Oyebode, 2025). That is relevant here because NASRDA has described a blockchain-enabled geospatial service for secure data sharing (NASRDA, 2025a). At constitutional level, section 37 guarantees the privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications, and section 45 permits derogations by laws that are reasonably justifiable in a democratic society in the interest of defence, public safety, public order, public morality, public health or the protection of others’ rights (Federal Republic of Nigeria, 1999). The text of section 37 names homes. Whether overhead imaging engages it is untested, as far as I could find.

4Where the two regimes meet

4.1Identifiability along the data chain

The United Nations principles define primary data as raw data acquired by sensors on a space object, processed data as the products of processing primary data, and analyzed information as the result of interpreting processed data (United Nations General Assembly, 1986). Table 1 maps these tiers onto the Nigerian provisions that are engaged. The examples are mine and illustrative. The point is that identifiability is not a property of a satellite or of a resolution figure; it grows as data moves down the chain and is joined to other information.

Data tier	Illustrative product	Personal data risk	Main Nigerian provisions
Primary data	Raw optical or radar scenes	Low on its own; rises with sub-meter resolution and frequent revisit	NASRDA Act ss. 6(k), 9; NDPA only if individuals are identifiable
Processed data	Georeferenced imagery, mosaics, time series	Moderate; location data can be tied to land or property records	Handbook midstream license; NDPA ss. 2, 28, 65
Analyzed information	Plot-level farm maps tied to named farmers; building or vehicle activity records	Highest; direct linkage to households and individuals	NDPA ss. 28, 41 to 43; Constitution s. 37; GAID

The tiers follow Principle I of United Nations General Assembly Resolution 41/65 (1986). The product examples and risk ratings are the author’s illustration, not measured data. Sources: United Nations General Assembly (1986); Federal Republic of Nigeria (2023); NASRDA (2025b).

4.2Four friction points

Who is the controller? The Act defines a controller as the person who alone or jointly determines the purposes and means of processing (Federal Republic of Nigeria, 2023, s. 65). As the statutory repository of satellite data over Nigeria, NASRDA decides what is archived, for how long and for whom, which suggests that it acts as a controller for the national archive. Licensed midstream processors may be controllers in their own right or processors acting for NASRDA or a client. This is my reading and not a settled position, and the Handbook does not allocate the roles. Where roles are unclear, duties such as impact assessments and breach response can fall between institutions.

Offshore processing. The transfer rule attaches to personal data, not to imagery as such. The same scene can move abroad freely for analysis and become subject to sections 41 to 43 only once it is linked to identifiable people. A processor that moves imagery offshore for cloud analytics therefore needs to know at what point its pipeline crosses that line. The same boundary matters for data coming in. NASRDA reports that it has received daily images from foreign satellites through an international cooperation node since January 2023 (NASRDA, 2025a). International law gives Nigeria, as a sensed State, access to primary and processed data about its territory on a non-discriminatory basis and on reasonable cost terms, and requires that sensing not be conducted to the detriment of the sensed State’s legitimate rights and interests (United Nations General Assembly, 1986, Principles IV and XII). It does not let Nigeria prevent sensing. Access, not control, is what international law supplies, so the domestic levers of licensing and data protection carry the weight.

The national security exemption. Both regimes use national security. It is a licensing condition under the NASRDA Act and an exemption under the Data Protection Act. Security agencies are likely to be principal users of sub-meter imagery. The exemption applies only to a competent authority and only as necessary, and sections 24 and 25 still apply, but an analysis of Nigerian surveillance law finds that the framework offers judicial safeguards while lacking user notification and an oversight mechanism requiring transparency (Banwo & Ighodalo, 2025). Notification is unrealistic for people who are imaged from orbit, so institutional reporting would have to do the work that notice cannot.

Sovereign access and data policy. None of the sources I reviewed on the new satellite program describes how the data will be stored, shared or protected (Adetola, 2024; Nyangi, 2024; Azubuike, 2026). Figure 1 locates the legal triggers along the data chain. Where the chain has no stated policy, the legal triggers operate by default and not by design.

Figure 1. The earth observation data chain in Nigeria and the legal triggers at each stage. The upper row shows data moving from the satellite through primary data, the NASRDA national archive and licensed processing to processed data and analyzed information. The lower row shows the provisions engaged at each stage. Sources: NASRDA Act 2010 as described by Faleti (2021); NASRDA (2025b); Federal Republic of Nigeria (1999, 2023); United Nations General Assembly (1986).

5Gaps and risks

Table 2 summarizes how far each instrument reaches earth observation data. The pattern is consistent. The space instruments govern who may operate and process but, in the texts reviewed, say nothing about personal data. The data protection instruments govern personal data but say nothing about imagery. The risk is not that either regime is weak. It is that each assumes the other is somebody else’s job, and that the new satellites will start producing finer data before anyone has decided who answers for it.

Instrument	Relevant provisions	Personal data addressed?	Offshore processing?	National security role
NASRDA Act 2010	s. 6(k) repository; s. 9 licensing	Not in provisions reviewed	Not in provisions reviewed	License condition (s. 9)
Handbook 2025	Upstream, midstream and downstream licenses; portal; monitoring	Not mentioned in text reviewed	Not mentioned in text reviewed	Compliance monitoring and sanctions
NDPA 2023	ss. 2, 28, 41 to 43, 65	Yes, where an individual is identifiable	Yes, ss. 41 to 43	Exemption for competent authorities, s. 3(2)(c)
GAID 2025	Impact assessment template; emerging technology rules	Through the Act	Not reviewed (commentary only)	Not reviewed (commentary only)

“Not in provisions reviewed” means that I found no relevant text in the sources listed, not that none exists. Sources: Faleti (2021); NASRDA (2025b); Federal Republic of Nigeria (2023); Aluko & Oyebode (2025).

Timing is the other risk. The new satellites are close to procurement, the National Space Policy is under revision (Iderawumi, 2025), and the Commission’s implementation directive has only just taken effect. Each of those is a point at which data governance can be written in at little cost. After launch, it can only be added to systems that are already running.

6Recommendations

First, NASRDA and the Nigeria Data Protection Commission should conclude a joint protocol. It should state when earth observation products are treated as personal data, using a risk matrix built from resolution, revisit frequency and the availability of linking data, and it should say who acts as controller for the national archive. Second, the Handbook should be supplemented with data governance conditions for midstream licensees: a data privacy impact assessment, using the GAID template, for products above an agreed risk level; data minimization and retention limits; access logging; processor contracts; and offshore processing arrangements that follow sections 41 to 43. The annual midstream renewal is a natural point at which to check compliance.

Third, Nigeria should adopt a tiered national earth observation data policy before the new satellites enter service. A workable version would separate openly released data, restricted data and security-controlled data, set out the justification for each tier, and decide in advance what resolution is released publicly. If the blockchain-enabled geospatial service that NASRDA has described is deployed (NASRDA, 2025a), it could keep tamper-evident records of who has accessed what. Fourth, security use of NASRDA data should proceed under a written protocol that records necessity and proportionality, follows any guidance notices the Commission issues under section 3(4), and produces an annual aggregate report, which addresses the transparency gap noted in Section 5.

Fifth, the revision of the National Space Policy should include a data chapter, and the repository function in the NASRDA Act should be read, and where necessary amended, so that it sits comfortably with the Data Protection Act. Sixth, further research should test these proposals: interviews with regulators and licensees, case studies of imagery products that approach the identifiability threshold, and technical work on what the new sensors can resolve. Without that evidence, any numerical resolution threshold would be a guess, which is why I recommend a risk matrix instead of a fixed figure.

7Conclusion

Nigeria is building the capacity to see its territory at a scale that has not been available to it before. The legal question that follows is not whether imagery is regulated, since the space regime licenses those who process it, but whether the regulation reaches the point at which imagery becomes information about people. On the texts reviewed, it does not yet. The Data Protection Act is broad enough to cover that point, and the space regime has the licensing levers to enforce conditions, but the two have not been connected. The connection can be made by agreement between two institutions, by conditions in licenses that are already renewed every year, and by a national data policy, and, in my view, none of these requires new primary legislation. The window for doing so cheaply is the period before the new satellites begin to deliver data. Future research should test the identifiability claims empirically and monitor how the space and data protection regulators approach the question in practice.

References

1. [1]Adetola A (2024). NASRDA partners with ProForce to build satellite constellation. Space in Africa, 7 August 2024. https://spaceinafrica.com/?p=142173
2. [2]Afriwise (2026). The orbit of space governance: Understanding Nigeria’s multilayered satellite legal frameworks. 29 January 2026. https://www.afriwise.com/blog/the-orbit-of-space-governance-understanding-nigerias-multilayered-satellite-legal-frameworks
3. [3]Aluko & Oyebode (2025). NDPC GAID takes effect on 19 September: Is your organisation prepared? 17 September 2025. https://aluko-oyebode.com/insights/ndpc-gaid-takes-effect-on-19-september-is-your-organisation-prepared/
4. [4]Azubuike E (2026). Nigeria’s $2 billion satellite procurement reaches 95% completion. Nairametrics, 2 October 2026. https://nairametrics.com/2026/10/02/nigerias-2-billion-satellite-procurement-reaches-95-completion/
5. [5]Banwo & Ighodalo (2023). Summary of the Nigeria Data Protection Act 2023 [Grey Matter briefing]. 22 June 2023. https://www.banwo-ighodalo.com/media-files/2024/01/908710c62e3fce362d559eaf7ee7932f.pdf
6. [6]Banwo & Ighodalo (2025). Legal exceptions to privacy rights in Nigeria: Implications for data subjects and recommended safeguards against arbitrary surveillance. Afriwise, 30 October 2025. https://www.afriwise.com/blog/legal-exceptions-to-privacy-rights-in-nigeria-implications-for-data-subjects-and-recommended-safeguards-against-arbitrary-surveillance
7. [7]Bu-Pasha S, Kuusniemi H (2021). Data protection and space: What challenges will the General Data Protection Regulation face when dealing with space-based data? Journal of Data Protection & Privacy, 4(1), 52–58.
8. [8]Faleti J (2021). The NASRDA Act: Beyond a domestic implementation of international space obligations. Space in Africa, 14 April 2021. https://spaceinafrica.com/2021/04/14/the-national-space-research-and-development-agency-act-beyond-a-domestic-implementation-of-international-space-obligations/
9. [9]Federal Republic of Nigeria (1999). Constitution of the Federal Republic of Nigeria 1999 (as amended), ss. 37 and 45.
10. [10]Federal Republic of Nigeria (2010). National Space Research and Development Agency Act.
11. [11]Federal Republic of Nigeria (2023). Nigeria Data Protection Act, 2023 (Act No. 37; Official Gazette No. 119, Vol. 110, 1 July 2023). https://ncc.gov.ng/media/801/view
12. [12]Iderawumi M (2025). Nigeria targets stronger space oversight in line with global trends. Space in Africa, 8 April 2025. https://spaceinafrica.com/2025/04/08/nigeria-targets-stronger-space-oversight-in-line-with-global-trends/
13. [13]National Space Research and Development Agency (NASRDA) (n.d.). Mandate. https://nasrda.gov.ng/mandate/
14. [14]National Space Research and Development Agency (NASRDA) (2025a). National statement of Nigeria, 62nd session of the Scientific and Technical Subcommittee, United Nations Committee on the Peaceful Uses of Outer Space. February 2025. https://www.unoosa.org/documents/pdf/copuos/stsc/2025/Statements/3_Nigeria.rev3.pdf
15. [15]National Space Research and Development Agency (NASRDA) (2025b). Handbook on space regulation and spectrum management. https://spacereg.nasrda.gov.ng/wp-content/uploads/2025/04/HANDBOOK-ON-SPACE-REGULATION-AND-SPECTRUM-MANAGEMENT.pdf
16. [16]Nyangi S (2024). Nigeria set to launch four new satellites to strengthen space technology. Space in Africa, 20 October 2024. https://spaceinafrica.com/2024/10/20/nigeria-set-to-launch-four-new-satellites-to-strengthen-space-technology/
17. [17]Rapp L, Santos C (2019). Satellite imagery, very high-resolution and processing-intensive image analysis: Potential risks under the GDPR. Air & Space Law, 44(3), 275–296.
18. [18]Shi Y (2022). Earth observation applications and the right to privacy: Within and beyond the COVID-19 pandemic. Jurnal Media Hukum, 29(2), 107–119. https://scholarlypublications.universiteitleiden.nl/access/item:3514728/view
19. [19]United Nations General Assembly (1986). Principles relating to remote sensing of the Earth from outer space (Resolution 41/65, 3 December 1986). https://digitallibrary.un.org/record/126423